Control device

Abstract

The control device (10) of the present invention comprises: a microcontroller (50); a power supply circuit (41, 42) for supplying power to the microcontroller (50); power supply lines (71, 72, 712, 722, 713, 723) and GND lines (73, 732, 733) for connecting the power supply circuit (41, 42) and components of the microcontroller (50); and capacitor units (66, 67, 616) configured to connect the power supply lines and the GND lines to suppress fluctuations in the supplied power. The capacitor units (66, 67, 616) are of a series structure.

Description

[0001] CROSS-REFERENCE TO RELATED APPLICATIONS

[0002] This application is based on Japanese Patent Application No. 2019-236619 filed on December 26, 2019, the contents of which are incorporated herein by reference. Technical Field

[0003] The present invention relates to a control device. Background Art

[0004] In recent years, with the increase in required capabilities, most systems related to the operation of machines have been electronically controlled. In addition, the control of systems that are key to performance improvement and automation has become more complicated, which has led to higher performance of control devices and an increase in components. On the other hand, in the event of a failure of a component of the control device, since the system may become a dangerous mode, it is necessary to reliably implement functional safety design to reduce risks. In Patent Document 1, in an electric power steering device, various circuits including a microcontroller (hereinafter appropriately referred to as a "microcomputer") are completely dual-systemed and a redundant structure is adopted.

[0005] Patent Document 1: International Publication No. 2018 / 042657 Summary of the Invention

[0006] However, simply dualizing the various circuits in a control device doubles the number of components, significantly increasing the failure rate and product cost. The defect rate is proportional to the failure rate. The present disclosure aims to provide a control device that achieves both high functional safety and a low defect rate at low cost.

[0007] The inventors of the present invention have discovered that in order to improve the above-mentioned contradiction, it is not necessary to simply dual-systemize the various circuits of the control device, but it is effective to make a comprehensive judgment based on the reduction effect of the failure rate of the failure mode that causes dangerous failures (hereinafter referred to as the dangerous failure rate), the increase or decrease in the functional failure rate, and the cost required for the countermeasures. It is effective to selectively take countermeasures against the failure modes that cause dangerous failures.

[0008] The control device disclosed herein includes: a microcontroller; a power supply circuit for supplying power to the microcontroller; a power line and a ground line for connecting the power supply circuit to components of the microcontroller; and a capacitor unit configured to connect the power line and the ground line to suppress fluctuations in the supplied power. The capacitor unit has a series structure.

[0009] By configuring the capacitors in series, the impact of a short-circuit failure is reduced to the level of electrostatic capacitance, minimizing the impact on the system including the control device. This reduces the risk of dangerous failures. Furthermore, compared to integrating the microcomputer and its peripheral circuits into a dual system, configuring the capacitors in series, for example by using multiple capacitors, can reduce the risk of functional failures, and the cost-effectiveness of this reduction in risk is very high. Therefore, the control device described above can achieve both high functional safety and a low defect rate at a low cost.

[0010] In this specification, the term "power supply lines and GND lines connecting the power supply circuit to the components of the microcontroller" encompasses both external and internal portions of the microcontroller. Specifically, power supply lines and GND lines may include not only portions connecting the power supply circuit terminals to the microcontroller terminals, but also portions connecting the power supply circuit terminals to internal components (i.e., electronic components) within the microcontroller.

[0011] In this specification, the term "series-structured capacitor unit" includes a system in which a plurality of capacitors are connected in series and a system in which three or more internal electrodes are arranged in series within a single capacitor. BRIEF DESCRIPTION OF THE DRAWINGS

[0012] The above-mentioned objects and other objects, features and advantages of the present disclosure can be further clarified by the following detailed description with reference to the accompanying drawings. The accompanying drawings are as follows:

[0013] Figure 1 It is a configuration diagram of the control device according to the first embodiment.

[0014] Figure 2 It shows Figure 1 A diagram of a microcomputer and its peripheral structure.

[0015] Figure 3 It schematically shows the installation Figure 1 A cross-sectional view of a microcomputer substrate.

[0016] Figure 4 This is a diagram showing a microcomputer and its peripheral configuration in a control device according to a second embodiment.

[0017] Figure 5 This is a diagram showing a microcomputer and its peripheral configuration in a control device according to a third embodiment.

[0018] Figure 6 This is a diagram showing a microcomputer and its peripheral configuration in a control device according to a fourth embodiment.

[0019] Figure 7 This is a diagram showing a capacitor portion of a control device according to a fifth embodiment.

[0020] Figure 8 This is a diagram showing a microcomputer and its peripheral configuration in a control device of a reference system.

[0021] Figure 9 This table summarizes the items calculated using a circuit design method that aims to achieve high functional safety, low defect rates, and low costs. DETAILED DESCRIPTION

[0022] Hereinafter, a plurality of embodiments of the control device will be described based on the drawings. Components that are substantially the same between the embodiments are denoted by the same reference numerals, and description thereof will be omitted.

[0023] [First embodiment]

[0024] like Figure 1 As shown, the ECU 10 as a control device in the first embodiment controls the motor 11. The ECU 10 and the motor 11 are used together in, for example, an electric power steering device for assisting a steering operation of a vehicle.

[0025] In this embodiment, the motor 11 is a three-phase brushless motor having two winding sets 12 and 13. The motor 11 rotates with power from a battery power supply 14. The battery power supply 14 is electrically connected to the high-potential side of a battery 15, which serves as an external power source mounted on the vehicle. Power at a predetermined external power supply voltage is supplied from the battery 15 to the battery power supply 14. In this embodiment, the external power supply voltage is normally approximately 12V.

[0026] The ECU 10 includes drive circuits 21 and 22 , rotation angle sensor circuits 31 and 32 , power supply circuits 41 and 42 , a microcomputer 50 , and the like.

[0027] The first drive circuit 21 is a three-phase inverter that converts power from the battery power source 14 using six switching elements (not shown) and supplies the power to the three windings of the first winding group 12. The second drive circuit 22 has the same structure as the first drive circuit 21 and supplies power to the three windings of the second winding group 13. The drive circuits 21 and 22 are dual-system, providing a redundant configuration.

[0028] The first rotation angle sensor circuit 31 detects the rotation angle θ1 of the motor 11 and outputs a detection signal to the microcomputer 50. The second rotation angle sensor circuit 32 detects the rotation angle θ2 of the motor 11 and outputs a detection signal to the microcomputer 50. The rotation angle sensor circuits 31 and 32 are dual-systemed, providing a redundant configuration. Detection signals from the torque sensor 16, vehicle speed sensor 17, and other sensors are also input to the microcomputer 50.

[0029] One end of a first power supply circuit 41 (hereinafter referred to as a VCC power supply circuit 41) is connected to the battery power supply 14. The VCC power supply circuit 41 outputs a predetermined first voltage, which is lower than the external power supply voltage (approximately 12V), from the other end and supplies it to the microcomputer 50. In this embodiment, the VCC power supply circuit 41 normally outputs a stable first voltage of, for example, approximately 5V.

[0030] One end of the second power supply circuit 42 (hereinafter referred to as the VCM power supply circuit 42) is connected to the battery power supply 14. The VCM power supply circuit 42 outputs a predetermined second voltage lower than the first voltage from the other end and supplies it to the microcomputer 50. In this embodiment, the VCM power supply circuit 42 normally outputs a stable second voltage of, for example, approximately 1.2 V.

[0031] The microcomputer 50 is a semiconductor package including a CPU, ROM, RAM, I / O, etc. The microcomputer 50 performs calculations based on signals from the rotation angle sensor circuits 31 and 32, the torque sensor 16, the vehicle speed sensor 17, etc., according to a program stored in the ROM, generates control signals, and outputs them to the drive circuits 21 and 22 to control the motor 11.

[0032] (Microcomputer peripheral structure)

[0033] Next, a description will be given of the peripheral configuration of the microcomputer 50. Prior to this description, a reference method and its problems will be described.

[0034] In recent years, microcomputers have been experiencing increasing speeds, driven by their advanced functionality. Meanwhile, miniaturization of semiconductor processes has led to thinner wiring within microcomputer chips. This has led to an increasing number of power and ground terminals within a microcomputer, and an increasing number of stabilizing capacitors to suppress fluctuations in the supplied power. In systems such as electric power steering, there are cases where microcomputer functional failure and short-circuit failure of the stabilizing capacitors can lead to ASIL-C-level dangerous failures. ASIL stands for Automotive Safety Integrity Level.

[0035] Therefore, reliable implementation of functional safety design is necessary to reduce risks. In this regard, as disclosed in International Publication No. 2018 / 042657, one consideration is to fully dualize various circuits, including the microcomputer, to adopt a redundant architecture. However, simply dualizing the various circuits in the control device would double the number of components, significantly increasing the failure rate and product cost. Nevertheless, dualization is unavoidable in situations where ASIL-D functional stoppage is required, such as in autonomous driving.

[0036] Therefore, in this embodiment, a circuit design method that aims to achieve both high functional safety, low defect rate, and low cost is used for design. Specifically, the design is performed according to the following (steps 1) to (steps 3).

[0037] (Step 1) Implement the structure before redundancy, that is, Figure 8 The FMEDA (Failure Mode, Effect and Diagnostic Analysis) in the reference method shown calculates components that may be dangerous due to failure, their failure modes, and the failure rate of the failure mode (hereinafter referred to as the dangerous failure rate).

[0038] (Step 2) Analyze the countermeasures, the effect of the countermeasures on reducing the dangerous failure rate, the increase or decrease in the functional failure rate, the required cost, and the required size (such as the installation area, etc.) in order of dangerous failure rate.

[0039] (Step 3) Based on the factors in (Step 2) above, a comprehensive judgment is made and the design is performed to meet the three goals of target failure rate (PMHF: Probabilistic Metric for random Hardware Failure: random hardware failure probability metric), single fault detection rate (SPFM: Single-Point Fault Metric: single-point fault metric), and latent fault detection rate (LFM: Latent-Fault Metric).

[0040] exist Figure 8 In the reference embodiment shown, microcomputer 50 has eight power supply terminals (i.e., four VCC terminals and four VCM terminals) and eight GND terminals. The VCC terminal is connected to the output terminal of VCC power supply circuit 91 via power line 95, which is a surrounding wiring. The VCM terminal is connected to the output terminal of VCM power supply circuit 92 via power line 96, which is a surrounding wiring. The GND terminal is connected to the GND terminals of power supply circuits 91 and 92 via GND line 97, which is a surrounding wiring. A power stabilization capacitor 66 is provided near the power supply terminals of microcomputer 50 to connect power lines 95 and 96 to GND line 97. A power stabilization capacitor 67 is provided near the power supply circuits 91 and 92 to connect power lines 95 and 96 to GND line 97. An oscillator 55 is connected to microcomputer 50.

[0041] In the above reference method, Figure 9The results of the calculation of "hazardous components," "failure modes," and "dangerous failure rates" in step 1 are shown. The dangerous failure rate is the product of the occurrence rate of the failure mode, the failure rate of the component, and the number of components used.

[0042] Capacitor 61 is a commonly used multilayer ceramic capacitor. Due to its structural characteristics, the vast majority of its failure modes are short-circuit. For example, according to the IEC / TR62380 failure database, short circuits account for 90% of all failures and open circuits for 10%. Therefore, the dangerous failure rate of capacitor 61 is relatively high. Furthermore, due to the large number of capacitors 61 in use, the total dangerous failure rate of all capacitors 61 accounts for approximately 60% of the overall circuit.

[0043] On the other hand, the dangerous failure rate of microcomputer 50 is relatively low, at approximately 10% of the total circuit. Furthermore, while dual-system implementation is considered as a countermeasure against microcomputer downtime, as mentioned above, this would require all peripheral circuits of microcomputer 50, leading to a significant increase in the functional failure rate and product cost.

[0044] Therefore, it is effective to selectively take countermeasures against the failure mode that causes danger. It is determined that the best countermeasure is to only adopt the countermeasure of configuring the capacitor 61 in series. Figure 2 The peripheral structure of the microcomputer 50 is designed as shown.

[0045] like Figure 2 As shown, a capacitor unit 66 is provided near the microcomputer 50 to connect the power lines 71, 72 and the GND line 73. In addition, a capacitor unit 67 is provided near the power circuits 41, 42 to connect the power lines 71, 72 and the GND line 73. The capacitor units 66 and 67 suppress the fluctuation of the supplied power and form a series structure. In this embodiment, the capacitor unit 66 is formed by connecting a plurality of capacitors 61 in series, and the capacitor unit 67 is formed by connecting a plurality of capacitors 62 in series. Figure 2 The oscillator is omitted from the illustration.

[0046] Power lines 71, 72 and GND line 73 connect the corresponding power supply circuits 41, 42 to the components of microcomputer 50 in a loop. Power lines 71, 72 and GND line 73 are loop-shaped wiring. In this embodiment, power lines 71, 72 and GND line 73 are external to microcomputer 50, that is, the parts that connect the terminals of power supply circuits 41, 42 to the terminals of microcomputer 50.

[0047] The output terminals and GND terminals of power supply circuits 41 and 42 are doubled. Power supply lines 71 and 72 and GND line 73 are looped, including the doubled output terminals or GND terminals of power supply circuits 41 and 42. Specifically, power supply line 71 loops together the output terminal of the doubled VCC power supply circuit 41 and the VCC terminal of microcomputer 50. Power supply line 72 loops together the output terminal of the doubled VCM power supply circuit 42 and the VCM terminal of microcomputer 50. GND line 73 loops together the GND terminals of the doubled power supply circuits 41 and 42 and the GND terminal of microcomputer 50.

[0048] like Figure 3 As shown, electronic components such as a microcomputer 50 are mounted on a substrate 56. The substrate 56 is a multi-phase substrate having a plurality of through holes 59 connecting different layers. Figure 3 In FIG, the microcomputer 50 is mounted on a layer 561 including a specific surface of the substrate 56. The power supply line and the GND line have a plurality of through-holes 59 arranged in parallel.

[0049] (Effect)

[0050] As described above, in the first embodiment, capacitors 66 and 67 are connected in series. This reduces the impact of a short-circuit failure on capacitors 61 and 62 to a reduced capacitance level, minimizing the impact on the system including ECU 10. This reduces the risk of dangerous failures. Furthermore, compared to integrating the microcomputer 50 and its peripheral circuits into a dual system, using multiple capacitors 61 and 62 to connect capacitors 66 and 67 in series reduces the risk of functional failures and offers a significantly higher cost-effectiveness compared to reducing the risk of dangerous failures. Therefore, the ECU 10 achieves both high functional safety and a low defect rate at a low cost.

[0051] In the first embodiment, the power lines 71, 72 and the GND line 73 connect the power circuits 41, 42 and the components of the microcomputer 50 in a loop. This can suppress the influence on the system caused by the disconnection of the power lines 71, 72 and the GND line 73.

[0052] In the first embodiment, the power lines 71, 72 and the GND line 73 have a plurality of through-holes 59 arranged in parallel. This can suppress the influence on the system caused by the disconnection of the power lines 71, 72 and the GND line 73.

[0053] Furthermore, in the first embodiment, the ECU 10 further includes dual-system drive circuits 21 and 22 and rotation angle sensor circuits 31 and 32 connected to the microcomputer 50. In such a control device having dual-system circuits, by not dualizing the microcomputer 50 and its peripheral circuits and instead configuring the capacitors 66 and 67 in series, further increases in the defective rate and product costs can be avoided.

[0054] Furthermore, in the first embodiment, the output terminals and the GND terminals of the power supply circuits 41 and 42 are doubled, thereby suppressing the influence on the system caused by a disconnection fault.

[0055] [Second embodiment]

[0056] In the second embodiment, if Figure 4 As shown, power lines 712, 722 and GND line 732 connect the power supply circuits 41, 42 to the microcomputer 50 in a mesh pattern. In this manner, each line may also be a mesh pattern. Except for the above, the second embodiment has the same structure and effects as the first embodiment.

[0057] [Third embodiment]

[0058] In a third embodiment, if Figure 5 As shown, power lines 713, 723 and GND line 733 connect the power supply circuit (not shown) to the microcomputer 50 in a planar shape (i.e., planar). In this way, each line can also be a planar wiring. Except for the above, the third embodiment has the same structure as the first embodiment and has the same effects as the first embodiment.

[0059] [Fourth embodiment]

[0060] In a fourth embodiment, if Figure 6 As shown, the intermediate points 69 of the series connection of the plurality of capacitor units 66 and 67 are connected to each other via an intermediate point connection line 75. This suppresses or increases the reduction in overall electrostatic capacitance in the event of a failure of capacitors 61 and 62. This allows for the reduction in the capacity of each capacitor, reducing product costs. Except for the above, the fourth embodiment has the same structure as the first embodiment and achieves the same effects as the first embodiment.

[0061] [Fifth embodiment]

[0062] In the fifth embodiment, if Figure 7As shown, capacitor section 616 is composed of a single multilayer ceramic capacitor, which is constructed by sandwiching a dielectric layer 84 between three internal electrodes 81, 82, and 83 in series. Consequently, even if an internal electrode disconnection or short circuit occurs, it will not be an extreme failure mode, and the impact on the system will be minimal. Furthermore, compared to directly connecting two or more capacitors, fewer components are required, resulting in a smaller mounting area. Except for the above, the fifth embodiment has the same structure as the first embodiment and achieves the same effects as the first embodiment.

[0063] [Other embodiments]

[0064] In other embodiments, the capacitor unit may be configured as three or more capacitors connected in series. Alternatively, the capacitor unit may be configured as a hybrid of multilayer ceramic capacitors and other types of capacitors. Alternatively, the series configuration of one capacitor unit may be different from the series configuration of other capacitor units.

[0065] In other embodiments, all of the plurality of electronic components constituting the ECU may be mounted on the same substrate, or some may be mounted on other substrates.

[0066] In other embodiments, the ECU may include a communication circuit or the like in addition to or instead of the drive circuit and the sensor circuit as two or more specific circuits connected to the microcomputer.

[0067] In other embodiments, the motor windings are not limited to three phases and may have other numbers of phases. The control device is not limited to an electric power steering device and may be, for example, a device for driving other parts of a vehicle. The control device is not limited to a vehicle and may control other general equipment.

[0068] The present disclosure is not limited to the above-described embodiment, and can be implemented in various forms within the scope not departing from the gist of the present disclosure.

[0069] The present disclosure has been described based on the embodiments. However, the present disclosure is not limited to the embodiments and configurations. The present disclosure also includes various modifications and variations within the scope of the equivalents. In addition, various combinations and methods, as well as other combinations and methods including only one element, more than one element, or less than one element, also fall within the scope and scope of the present disclosure.

Claims

1. A system for driving a motor connected to a microcontroller, wherein: have: A drive device includes a first drive circuit and a second drive circuit, wherein the first drive circuit and the second drive circuit have the same structure and are dual-systemed to form a redundant structure, and drives the motor; and / or The sensor device includes a first sensor circuit and a second sensor circuit. The first sensor circuit and the second sensor circuit have the same structure and are dual-systemed to form a redundant structure, and detect the rotation of the motor. The above system further comprises a control device, wherein the control device comprises: The aforementioned microcontroller; Batteries as external power sources; a power supply circuit that outputs a predetermined voltage lower than the voltage of the external power supply and supplies power to the microcontroller; A power line and a GND line connecting the power circuit to the components of the microcontroller; as well as The capacitor unit of the series structure is provided to connect the power supply line and the GND line to suppress fluctuations in the supplied power.

2. The system according to claim 1, wherein: At least one of the power line and the GND line connects the power circuit and components of the microcontroller in a mesh, loop, or plane shape.

3. The system according to claim 1 or 2, wherein: At least one of the power line and the GND line has a plurality of through-hole portions arranged in parallel.

4. The system according to claim 1 or 2, wherein: It also includes two or more specific circuits, which are composed of a drive circuit, a sensor circuit or a communication circuit and are connected to the microcontroller.

5. The system according to claim 1 or 2, wherein: At least one of the output terminal, the input terminal, and the GND terminal of the power supply circuit is doubled.

6. The system according to claim 1 or 2, wherein: The capacitor unit is provided in plurality. The control device further includes an intermediate point connection line that connects intermediate points of the series connection of the plurality of capacitor units.

7. The system according to claim 1 or 2, wherein: The capacitor portion includes a capacitor including three or more internal electrodes connected in series.

8. The system according to claim 6, wherein: The capacitor unit includes two capacitors connected in series with each other via the series connection intermediate point.

Images